synabun 2.0.0 → 2.0.7

package/neural-interface/lib/cloudflared/pins.json

@@ -0,0 +1,63 @@
+{
+  "version": "2026.10.0",
+  "baseUrl": "https://github.com/cloudflare/cloudflared/releases/download/2026.10.0/",
+  "release": "https://github.com/cloudflare/cloudflared/releases/tag/2026.10.0",
+  "license": "Apache-2.0",
+  "origin": "Cloudflare's own release files, the stable release of 2026-10-05. `sha256` is the digest GitHub publishes for the release asset (the `digest` of the asset in the releases API). `binary.sha256` is the checksum in the release's own notes (SHA256 Checksums): for the macOS archives that is the checksum of the cloudflared inside, for the other files it is the file itself. Each file was downloaded on 2026-10-13 and both values, and the sizes, were computed from it and found equal to what is published.",
+  "platforms": {
+    "darwin-arm64": {
+      "file": "cloudflared-darwin-arm64.tgz",
+      "sha256": "a2f79ff7b9420aa537d74af239f376da170bbabeb529aec416002adac6a72e70",
+      "size": 19809074,
+      "archive": "tgz",
+      "member": "cloudflared",
+      "binary": {
+        "sha256": "72edfd3eea463aef4d5cb89e2e209cecb048cc756c2b01915de2e0ad7cb39830",
+        "size": 39364384,
+        "format": "macho"
+      }
+    },
+    "darwin-x64": {
+      "file": "cloudflared-darwin-amd64.tgz",
+      "sha256": "903845b81828c8cb3c5d13d816a2de71c06a3da5785469df8eb0e1b736d92f9f",
+      "size": 21741581,
+      "archive": "tgz",
+      "member": "cloudflared",
+      "binary": {
+        "sha256": "0560c9ab7281ac3f746055323623ed23bc0405b6dab9400474020cba33a978da",
+        "size": 42328240,
+        "format": "macho"
+      }
+    },
+    "linux-x64": {
+      "file": "cloudflared-linux-amd64",
+      "sha256": "d33ff2d14475178d2012c2c56beba87389ac5ded27649519f198a7d3134a99db",
+      "size": 40129756,
+      "binary": {
+        "sha256": "d33ff2d14475178d2012c2c56beba87389ac5ded27649519f198a7d3134a99db",
+        "size": 40129756,
+        "format": "elf"
+      }
+    },
+    "linux-arm64": {
+      "file": "cloudflared-linux-arm64",
+      "sha256": "e6422b9d4f72d3194bc5a38676f13667c06666523217b842a877d72a80b5ac08",
+      "size": 37687584,
+      "binary": {
+        "sha256": "e6422b9d4f72d3194bc5a38676f13667c06666523217b842a877d72a80b5ac08",
+        "size": 37687584,
+        "format": "elf"
+      }
+    },
+    "win32-x64": {
+      "file": "cloudflared-windows-amd64.exe",
+      "sha256": "86aee4017b26625cee8484c113558f48effa4cd47f7aa05fcf425604e5d2b23c",
+      "size": 55365048,
+      "binary": {
+        "sha256": "86aee4017b26625cee8484c113558f48effa4cd47f7aa05fcf425604e5d2b23c",
+        "size": 55365048,
+        "format": "pe"
+      }
+    }
+  }
+}

package/neural-interface/lib/cloudflared/tunnel.js

@@ -0,0 +1,265 @@
+// ═══════════════════════════════════════════
+// SynaBun — the public address (a Cloudflare quick tunnel)
+// ═══════════════════════════════════════════
+//
+// `cloudflared tunnel --url http://localhost:<port>`: no Cloudflare account, an
+// address under trycloudflare.com for as long as the process runs. One tunnel
+// at a time. What server.js keeps of it are three thin routes (/api/tunnel/…)
+// and the address itself, which it needs for its Host and remote rules: it
+// gets every change through `onUrl`, the moment cloudflared prints the address.
+//
+//   start()   answers at once. Behind it: the copy of cloudflared to run
+//             (manager.js: a download on a machine that has none), then the
+//             process, then its address. A second start while one is on its
+//             way, or running, changes nothing.
+//   stop()    ends the process, and whatever a start was still waiting for.
+//   status()  what is happening, for the page: idle, downloading (with
+//             progress), starting, running (the address, which copy runs and
+//             its version), failed (a code and a sentence; a start tries again).
+//   shutdown()  stop(), then waits (a bounded time) until cloudflared has
+//             really exited. killNow(): at the server's exit, kill it now.
+//
+// A copy of SynaBun's own is started with --no-autoupdate: it is a pinned file,
+// and cloudflared would otherwise replace itself where it stands, inside an
+// installed application too. The user's own cloudflared is started as before.
+// Whatever copy it is, the manager checks it once more right before the start
+// (confirm: the very file its check read, by its real path), and that path is
+// what is started, at once.
+//
+// An ended process is not forgotten: it is asked to end (SIGTERM), killed when
+// it is still there a moment later (SIGKILL), and kept until it has exited.
+
+import { spawn as nodeSpawn } from 'node:child_process';
+
+const exited = (proc) => !proc.pid || proc.exitCode !== null || proc.signalCode !== null;
+
+/**
+ * End a child process for sure: SIGTERM now, SIGKILL when it is still there `killAfterMs` later. Resolves once it
+ * has exited (at once for one that is gone, or never started). How long to wait for that is the caller's choice.
+ */
+export function endChild(proc, { killAfterMs = 1000 } = {}) {
+  return new Promise((done) => {
+    if (!proc || exited(proc)) { done(); return; }
+    let timer = null;
+    proc.once('exit', () => { clearTimeout(timer); done(); });
+    try { proc.kill('SIGTERM'); } catch { /* gone already */ }
+    timer = setTimeout(() => {
+      if (!exited(proc)) { try { proc.kill('SIGKILL'); } catch { /* gone already */ } }
+    }, killAfterMs);
+  });
+}
+
+/** The address of a quick tunnel, as cloudflared prints it. */
+const TUNNEL_URL = /https:\/\/([a-z0-9-]+)\.trycloudflare\.com/g;
+/** Names under trycloudflare.com that are Cloudflare's own, never a tunnel's (they appear in its error lines). */
+const NOT_A_TUNNEL = new Set(['api', 'www']);
+const OUTPUT_KEPT = 4096;
+
+/** The first quick-tunnel address in a piece of cloudflared's output, or null. */
+export function tunnelUrlIn(text) {
+  TUNNEL_URL.lastIndex = 0;
+  for (let match = TUNNEL_URL.exec(text); match; match = TUNNEL_URL.exec(text)) {
+    if (!NOT_A_TUNNEL.has(match[1])) return match[0];
+  }
+  return null;
+}
+
+/** The arguments cloudflared is started with for a copy from `source` (manager.js). */
+export function tunnelArguments(port, source) {
+  return ['tunnel', ...(source === 'system' ? [] : ['--no-autoupdate']), '--url', `http://localhost:${port}`];
+}
+
+/** What cloudflared said last that reads like a reason: its last error line, without the timestamp. */
+function lastReason(output) {
+  const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  const said = [...lines].reverse().find((line) => /\b(?:ERR|error|failed)\b/i.test(line)) || '';
+  return said.replace(/^\d{4}-\d{2}-\d{2}T[\d:.]+Z?\s+/, '').replace(/^(?:ERR|INF|WRN)\s+/, '').slice(0, 240);
+}
+
+/**
+ * @param {object} o
+ * @param {{ ensure: Function, inspect: Function, status: Function, cancel: Function, confirm?: Function, killNow?: Function }} o.cloudflared manager.js
+ * @param {number | string} o.port the port of this server
+ * @param {(url: string | null) => void} [o.onUrl] every change of the address: set when it is known, null when it is gone
+ * @param {typeof nodeSpawn} [o.spawn]
+ * @param {number} [o.urlTimeoutMs] how long a started cloudflared may take to print its address
+ * @param {number} [o.killAfterMs] how long an ended cloudflared has to exit before it is killed
+ * @param {(line: string) => void} [o.log]
+ */
+export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn = nodeSpawn, urlTimeoutMs = 90_000, killAfterMs = 1000, log = () => {} }) {
+  let phase = 'idle';   // idle | preparing | starting | running | failed
+  let child = null;
+  let url = null;
+  let copy = null;      // { source, version } of the cloudflared that runs
+  let error = null;     // { code, message, reason } of the start that failed, until the next one (`reason`: cloudflared's own words, when it gave any)
+  let attempt = 0;      // a start that is not the current attempt any more does nothing
+  let preparing = null; // the AbortController of the start that is getting its copy ready
+  const ending = new Map();   // a process that was asked to end → its endChild(): kept until it has really exited
+
+  /** Ask a process to end, kill it when it does not, and keep it until it has exited. */
+  function end(proc) {
+    if (!proc) return Promise.resolve();
+    if (!ending.has(proc)) ending.set(proc, endChild(proc, { killAfterMs }).then(() => { ending.delete(proc); }));
+    return ending.get(proc);
+  }
+
+  const setUrl = (value) => {
+    if (url === value) return;
+    url = value;
+    try { onUrl(value); } catch { /* the address is still ours to report */ }
+  };
+
+  function fail(code, message, reason = null) {
+    phase = 'failed';
+    error = { code, message, reason };
+    copy = null;
+    setUrl(null);
+    log(`  Tunnel:  ${code === 'ended' ? 'stopped' : 'not started'} (${code}): ${message}`);
+  }
+
+  function launch(found, mine) {
+    // Checked once more as it is about to run (the manager's confirm: the very file its check read, still where
+    // nobody else can change it), and started at once by the real path that was checked: nothing runs in between.
+    let path = found.path;
+    try {
+      if (typeof cloudflared.confirm === 'function') path = cloudflared.confirm(found);
+    } catch (failure) {
+      return fail(typeof failure?.code === 'string' ? failure.code : 'launch', failure?.message || String(failure));
+    }
+    let proc;
+    try {
+      proc = spawn(path, tunnelArguments(port, found.source), { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+    } catch (failure) {
+      return fail('launch', `cloudflared could not be started (${failure?.code || failure?.message || failure}).`);
+    }
+    child = proc;
+    copy = { source: found.source, version: found.version };
+    phase = 'starting';
+    let output = '';
+    const timer = setTimeout(() => {
+      if (mine !== attempt || phase !== 'starting') return;
+      child = null;
+      end(proc);
+      fail('no_address', `cloudflared gave no address within ${Math.round(urlTimeoutMs / 1000)} seconds.`, lastReason(output) || null);
+    }, urlTimeoutMs);
+    timer.unref?.();
+    // cloudflared prints the address to stderr, in pieces that can end anywhere: the search runs over what
+    // came last, not over one piece.
+    const read = (data) => {
+      output = (output + data.toString()).slice(-OUTPUT_KEPT);
+      if (mine !== attempt || phase !== 'starting') return;
+      const address = tunnelUrlIn(output);
+      if (!address) return;
+      clearTimeout(timer);
+      phase = 'running';
+      setUrl(address);
+      log(`  Tunnel:  ${address} (cloudflared ${found.version}, ${found.source})`);
+    };
+    proc.stdout?.on('data', read);
+    proc.stderr?.on('data', read);
+    proc.on('error', (failure) => {
+      clearTimeout(timer);
+      if (mine !== attempt || child !== proc) return;
+      child = null;
+      fail('launch', `cloudflared could not be started (${failure?.code || failure?.message || failure}).`);
+    });
+    proc.on('close', (code, signal) => {
+      clearTimeout(timer);
+      if (mine !== attempt || child !== proc) return;   // stopped on request, or already accounted for
+      child = null;
+      const said = lastReason(output) || null;
+      if (phase === 'running') fail('ended', 'The tunnel stopped by itself. Start it again for a new address.', said);
+      else fail('exited', said || `cloudflared stopped before it gave an address (${signal || `exit ${code}`}).`, said);
+    });
+    return undefined;
+  }
+
+  function answer(message) {
+    return { ok: true, state: phase, url, message };
+  }
+
+  function start() {
+    if (phase === 'running') return { ...answer('Already running.') };
+    if (phase === 'preparing' || phase === 'starting') return answer('Tunnel starting...');
+    const mine = ++attempt;
+    phase = 'preparing';
+    error = null;
+    copy = null;
+    setUrl(null);
+    // What the preparation runs (a hash, a `cloudflared --version`, a download) stops with this, on stop().
+    const ready = new AbortController();
+    preparing = ready;
+    const done = () => { if (preparing === ready) preparing = null; };
+    Promise.resolve().then(() => cloudflared.ensure({ signal: ready.signal })).then((found) => {
+      done();
+      if (mine === attempt) launch(found, mine);
+    }, (failure) => {
+      done();
+      if (mine !== attempt) return;
+      fail(typeof failure?.code === 'string' ? failure.code : 'unknown', failure?.message || String(failure));
+    });
+    return answer('Tunnel starting...');
+  }
+
+  function stop() {
+    const was = phase;
+    attempt++;
+    const proc = child;
+    child = null;
+    phase = 'idle';
+    error = null;
+    copy = null;
+    setUrl(null);
+    if (preparing) { preparing.abort(); preparing = null; }
+    if (was === 'preparing') { try { cloudflared.cancel(); } catch { /* nothing was running */ } }
+    end(proc);
+    return { ok: true, state: phase, message: was === 'idle' || was === 'failed' ? 'Not running.' : 'Tunnel stopped.' };
+  }
+
+  /**
+   * stop(), and a wait until cloudflared has really exited (killed when it does not end by itself): at most
+   * `timeoutMs`, so the server's shutdown never waits on it for long. `exited` says whether it did by then.
+   */
+  async function shutdown({ timeoutMs = 2000 } = {}) {
+    const stopped = stop();
+    let timer = null;
+    const exitedInTime = await Promise.race([
+      Promise.all([...ending.values()]).then(() => true),
+      new Promise((done) => { timer = setTimeout(() => done(false), timeoutMs); }),
+    ]);
+    clearTimeout(timer);
+    return { ...stopped, exited: exitedInTime && ending.size === 0 };
+  }
+
+  /** At the server's exit, when nothing can be waited for: every cloudflared this started that is still there is killed now. */
+  function killNow() {
+    stop();
+    for (const proc of ending.keys()) { if (!exited(proc)) { try { proc.kill('SIGKILL'); } catch { /* gone already */ } } }
+    try { cloudflared.killNow?.(); } catch { /* nothing of its own runs */ }
+  }
+
+  async function status() {
+    // While a start waits for the copy, the manager is asked what it knows, not sent to look again.
+    let tool;
+    try { tool = phase === 'preparing' ? cloudflared.status() : await cloudflared.inspect(); } catch (failure) { tool = { ...cloudflared.status(), state: 'failed', error: { code: 'unknown', message: failure?.message || String(failure) } }; }
+    const downloading = phase === 'preparing' && tool.state === 'downloading';
+    return {
+      ok: true,
+      // What a page that predates the download reads: can a tunnel be started here, is one up, is one on its way.
+      available: tool.state !== 'unsupported',
+      running: phase === 'running' || phase === 'starting',
+      starting: phase === 'preparing' || phase === 'starting',
+      url,
+      state: downloading ? 'downloading' : phase === 'preparing' ? 'starting' : phase,
+      error,
+      cloudflared: {
+        ...tool,
+        // The copy that runs, when one does; otherwise the one a start would run.
+        source: copy?.source ?? tool.source,
+        version: copy?.version ?? tool.version,
+      },
+    };
+  }
+
+  return { start, stop, status, url: () => url, phase: () => phase, shutdown, killNow };
+}

package/neural-interface/lib/codex-account-auth.js

@@ -0,0 +1,178 @@
+// Codex account sign-in state and changes (docs/codex-sidepanel.md → Codex
+// accounts). Codex owns its ChatGPT login and its store; SynaBun owns only the
+// API key it keeps per account (lib/codex-accounts.js). This adapter asks
+// Codex what an account's own store holds (`account/read` from an app-server
+// started under that account), signs a credential out, saves a pasted key
+// after OpenAI accepts it, and changes an account's mode, each through
+// `changeCredentials` so the account's idle panel processes restart under the
+// new credential and busy ones refuse the change.
+import { spawn } from 'node:child_process';
+import { verifyOpenAiApiKey } from './claude-profile-api-key.js';
+import { validateProviderApiKey } from './provider-panel-api-key-auth.js';
+import { applyCodexLaunchEnv } from './codex-accounts.js';
+
+const fail = (message, status = 409, code = null) => Object.assign(new Error(message), { status, ...(code ? { code } : {}) });
+
+export function createCodexAccountAuth({
+  accounts,
+  codexBin = () => 'codex',
+  env = () => process.env,
+  spawnProcess = spawn,
+  prepareConfig = () => {},
+  statusTimeoutMs = 15_000,
+  verifyKey = verifyOpenAiApiKey,
+  changeCredentials = async (_id, change) => change(),
+} = {}) {
+  if (!accounts) throw new Error('createCodexAccountAuth requires accounts');
+  function account(id) {
+    if (typeof id !== 'string' || !/^[a-z0-9-]{1,64}$/.test(id)) throw fail('Unknown Codex account', 404);
+    const row = accounts.profileFor(id);
+    if (!row || row.id !== id) throw fail('Unknown Codex account', 404);
+    return row;
+  }
+  // Codex run under the account's own store: inherited credentials out, its
+  // CODEX_HOME in, never the key SynaBun holds (that is not Codex's store).
+  function launch(id, args) {
+    account(id);
+    const plan = accounts.launchFor(id);
+    if (!plan.ok) throw fail(plan.message, 404);
+    prepareConfig(plan.home);
+    let file = codexBin();
+    if (!file) throw fail('Codex CLI not found. Install Codex to sign in.', 503);
+    const script = /\.[cm]?js$/i.test(file);
+    const shell = process.platform === 'win32' && /\.(cmd|bat)$/i.test(file);
+    const proc = spawnProcess(script ? process.execPath : file, script ? [file, ...args] : args, {
+      env: { ...applyCodexLaunchEnv(env(), { unset: plan.unset, env: plan.env }), NO_COLOR: '1' },
+      stdio: ['pipe', 'pipe', 'pipe'], shell, windowsHide: true,
+    });
+    proc.stdin?.on('error', () => {});
+    return proc;
+  }
+  /** What Codex says the account's own store holds: { account: { type, email, planType } | null }. Never a credential. */
+  function nativeRead(id, method, params, { signal, timeoutMs = statusTimeoutMs } = {}) {
+    return new Promise((resolve, reject) => {
+      let proc;
+      try { proc = launch(id, ['app-server']); } catch (error) { reject(error); return; }
+      let buffer = '', settled = false, nextId = 1;
+      const waiting = new Map();
+      const finish = (error, result) => {
+        if (settled) return;
+        settled = true; clearTimeout(timer); signal?.removeEventListener('abort', abort);
+        try { proc.stdin.end(); } catch {}
+        try { proc.kill(); } catch {}
+        error ? reject(error) : resolve(result);
+      };
+      const abort = () => finish(new Error('Codex account read cancelled.'));
+      const timer = setTimeout(() => finish(new Error('Codex did not answer in time. Try Refresh.')), timeoutMs);
+      timer.unref?.();
+      signal?.addEventListener('abort', abort, { once: true });
+      if (signal?.aborted) { abort(); return; }
+      const call = (method, params) => new Promise((ok, no) => {
+        const callId = nextId++;
+        waiting.set(callId, { ok, no });
+        try { proc.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id: callId, method, params })}\n`); }
+        catch (error) { waiting.delete(callId); no(error); }
+      });
+      proc.stdout.setEncoding?.('utf8');
+      proc.stdout.on('data', (chunk) => {
+        buffer = (buffer + chunk).slice(-1_048_576);
+        let index;
+        while ((index = buffer.indexOf('\n')) >= 0) {
+          const line = buffer.slice(0, index).trim();
+          buffer = buffer.slice(index + 1);
+          if (!line) continue;
+          let msg;
+          try { msg = JSON.parse(line); } catch { continue; }
+          if (msg.id === undefined || msg.method) continue;
+          const entry = waiting.get(msg.id);
+          if (!entry) continue;
+          waiting.delete(msg.id);
+          if (msg.error) entry.no(new Error('Codex could not read the account.'));
+          else entry.ok(msg.result);
+        }
+      });
+      proc.stderr.on('data', () => {}); // Never forward CLI output: it can carry credential details.
+      proc.on('error', () => finish(new Error('Could not start Codex. Check its installation.')));
+      proc.on('close', () => finish(new Error('Codex closed before it answered.')));
+      (async () => {
+        try {
+          await call('initialize', { clientInfo: { name: 'synabun-codex-accounts', title: 'SynaBun Codex accounts', version: '0.0.1' } });
+          proc.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'initialized' })}\n`);
+          finish(null, await call(method, params));
+        } catch (error) { finish(error); }
+      })();
+    });
+  }
+  async function nativeStatus(id) {
+    const result = await nativeRead(id, 'account/read', { refreshToken: false });
+    const native = result?.account && typeof result.account === 'object' ? result.account : null;
+    return { account: native ? { type: native.type || null, email: native.email || null, planType: native.planType || null } : null };
+  }
+  const rateLimits = (id, options) => nativeRead(id, 'account/rateLimits/read', {}, options);
+  // `codex logout` in the account's home: Codex removes its own login (auth.json or its keyring entry).
+  function nativeLogout(id) {
+    return new Promise((resolve, reject) => {
+      let proc, timer;
+      try { proc = launch(id, ['logout']); } catch { reject(fail('Could not sign out of Codex. Try again.', 500)); return; }
+      let settled = false;
+      const finish = (ok) => { if (settled) return; settled = true; clearTimeout(timer); ok ? resolve() : reject(fail('Could not sign out of Codex. Try again.', 500)); };
+      proc.stdout.on('data', () => {}); proc.stderr.on('data', () => {});
+      proc.on('error', () => finish(false));
+      proc.on('close', (code) => finish(code === 0));
+      timer = setTimeout(() => { try { proc.kill(); } catch {} finish(false); }, statusTimeoutMs);
+      timer.unref?.();
+    });
+  }
+  /** The account as every surface shows it, after asking Codex about its own store. */
+  async function read(id) {
+    account(id);
+    let failure = null;
+    try { await accounts.refreshStatus([id], { force: true }); } catch (error) { failure = error; }
+    account(id);
+    const row = accounts.describeForClient(id);
+    if (failure && !row) throw failure;
+    return { accountId: id, account: row };
+  }
+  const pending = new Set();
+  async function guarded(id, work) {
+    account(id);
+    if (pending.has(id)) throw fail('Another sign-in change for this account is still running.');
+    pending.add(id);
+    try { return await work(); } finally { pending.delete(id); }
+  }
+  async function signInApiKey(id, key) {
+    account(id); key = validateProviderApiKey('codex', key);
+    try {
+      return await guarded(id, async () => {
+        await verifyKey(key);
+        account(id); // A removed account is never recreated by a late answer.
+        await changeCredentials(id, () => { account(id); accounts.saveApiKey(id, key); });
+      });
+    } finally { key = null; }
+  }
+  // `credential`: 'apiKey' removes the account's key (SynaBun's file, or Codex's own stored key),
+  // 'subscription' runs Codex's own logout in the account's home, 'all' both.
+  async function signOut(id, credential = 'all') {
+    account(id);
+    if (!['all', 'apiKey', 'subscription'].includes(credential)) throw fail('Choose which sign-in to remove.', 400);
+    return guarded(id, () => changeCredentials(id, async () => {
+      const row = accounts.describe(id);
+      const ownKey = row?.apiKey?.source === 'synabun';
+      const codexKey = row?.apiKey?.source === 'codex';
+      if (credential === 'apiKey' && !row?.apiKey?.present && !row?.apiKey?.error) throw fail(`${row?.label || id} has no API key.`);
+      if (credential === 'subscription' && codexKey) throw fail(`${row.label} has no ChatGPT sign-in: Codex holds an API key for it.`);
+      if (credential !== 'subscription' && (ownKey || row?.apiKey?.error)) accounts.clearApiKey(id);
+      // Codex's own store is cleared for a ChatGPT sign-out, or for a key Codex itself holds.
+      if (credential === 'subscription' || (credential === 'all' && !ownKey) || (credential === 'apiKey' && codexKey)) {
+        await nativeLogout(id);
+        accounts.noteNativeStatus(id, { account: null });
+      }
+      return accounts.describeForClient(id);
+    }));
+  }
+  /** What the account's sessions use from now on: its idle panel processes restart under it. */
+  async function setMode(id, mode) {
+    return guarded(id, () => changeCredentials(id, () => accounts.setMode(id, mode)));
+  }
+  return { read, nativeStatus, rateLimits, signInApiKey, signOut, setMode };
+}